EUVD-2026-97134
GHSA-4mf5-cv4x-v6qh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged JEEWMS account
-
DeliverySend crafted searchstr to WmSttInGoodsController.list
-
ExploitInject SQL via unsanitized parameter
-
ExecutionExecute injected query on database
-
ImpactExfiltrate or alter warehouse data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged session (CVSS PR:L) with access to the JEEWMS warehouse management application, after which a malicious payload is supplied through the 'searchstr' argument of the WmSttInGoodsController.list endpoint (src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java). The primary limiting factor is the authentication prerequisite - anonymous unauthenticated users cannot reach the vulnerable path - while no special non-default configuration or user interaction is needed. Affected builds are JEEWMS up to and including version 2026.09.27-W39. |
| Impact | Signals are modest and internally consistent, pointing to a real but low-to-moderate priority issue rather than an urgent emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity SQL injection that nonetheless requires an authenticated low-privileged account (PR:L), and the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L), yielding a 5.3 Medium score. Exploit maturity is flagged as Proof-of-Concept (E:P) and the description confirms publicly available exploit code exists. There is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - the public PoC indicates feasibility, not observed attacks. A notable caveat: all data originates from a single source (VulDB), the CWE-89 SQL injection class would normally permit full database read/write (often warranting High confidentiality/integrity impact), yet the vector only claims Low impact across the board - this conservative rating should be verified, as the real impact of an exploitable SQLi could be higher than the 5.3 score suggests. The vendor was contacted but did not respond, so no patch is confirmed available. |
| Exploit ScenarioDerived | An attacker who already holds a valid low-privileged JEEWMS account sends a crafted value in the 'searchstr' parameter to the WmSttInGoodsController.list endpoint, injecting SQL that the backend executes against the warehouse database. A public proof-of-concept exists, lowering the skill barrier; the attacker can enumerate or manipulate database contents within the limits of the application's database privileges. Exploitation is remote over the network but gated by the need for prior authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
SQL injection in erzhongxmu JEEWMS (versions up to and including 2026.09.27-W39) lets an authenticated low-privileged user inject arbitrary SQL through the 'searchstr' argument of the WmSttInGoodsController.list endpoint, potentially reading, tampering with, or disrupting warehouse-management data. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; there is no confirmed active exploitation (CISA KEV). With an assessed CVSS:4.0 base score of 5.3 and low confidentiality, integrity, and availability impact, this is a moderate-priority issue whose main limiting factor is the authentication prerequisite - anonymous, unauthenticated users cannot reach the vulnerable code path.
RemediationAI
No vendor-released patch has been identified at time of analysis: the vendor was contacted about the disclosure but did not respond, and no fixed version is cited in the available references, so teams cannot rely on an upstream release to close this issue. Until a fix appears, apply compensating controls targeted at the specific vulnerable path: restrict access to the WmSttInGoodsController.list endpoint (and JEEWMS administrative interfaces generally) to trusted authenticated users and, where feasible, internal network segments or VPN-only access - accepting reduced accessibility for legitimate warehouse staff as the trade-off; enforce strict server-side allowlist validation on the 'searchstr' parameter (rejecting or escaping SQL metacharacters such as quotes, comment markers, and UNION keywords) at the controller or a reverse-proxy/WAF layer, understanding that WAF signature rules are bypassable and should not be the sole control; and remediate at the code level by converting the affected query to a parameterized/prepared statement in the WmSttInGoodsController DAO path, which is the durable fix but requires an in-house code change since no official patch exists. Because publicly available exploit code exists, prioritize monitoring authentication and application logs for anomalous SQL-like strings in requests to this endpoint, and review database account privileges for the JEEWMS service to minimize the blast radius of any successful injection. Vendor-tracked references for ongoing status are https://vuldb.com/vuln/416559 and https://vuldb.com/cve/CVE-2026-108779.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JEEWMS is a Java-based open-source warehouse management system (WMS) built with Spring MVC, and the vulnerable component is the WmSttInGoodsController class located at src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. The list method passes the user-supplied 'searchstr' argument into a database query without proper neutralization, which is the classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) root cause: attacker-controlled text is interpreted as SQL syntax rather than as data. Because the parameter is reached over HTTP and the controller runs with the application's database privileges, successful injection can expose or modify records the query touches, and the impact class (VC:L/VI:L/VA:L) reflects limited, query-scoped effects rather than full database compromise. The CPE string cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:* uses a wildcard version range, indicating the affected code line spans released builds rather than a single tagged version. No special non-default configuration or user interaction is required to trigger the flaw once a valid low-privileged session exists.
Know when Jeewms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable endpoint (AV:N) with simple injection (AC:L) but needs a valid low-privileged account (PR:L); impacts kept Low to mirror the source's conservative vulnerable-system ratings.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Related Vulnerabilities in JEEWMS SQL Injection and Injection Flaws
View all 4An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. R
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information vi
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. Rated medium severity (CVSS 6.9), this v
A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute a
Jeewms 3.7 contains a server-side request forgery vulnerability in the UEditor plugin's getRemoteImage.jsp file, where t
Code injection in erzhongxmu JeeWMS via the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) all
Unauthenticated remote access to the Spring Boot Actuator endpoint in erzhongxmu JeeWMS exposes sensitive application in
A vulnerability was found in erzhongxmu Jeewms up to 20241108. Rated medium severity (CVSS 5.3), this vulnerability is r
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical.html o
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet
Reflected cross-site scripting in Jeewms up to version 3.7 exists in the UEditor component's getContent.jsp file through
Cross-site scripting (XSS) in the doAdd function of Jeewms up to version 3.7 allows unauthenticated remote attackers to
Exploit-DB